This invention relates to power bus switching arrangements for electronic circuits and, more particularly, to such arrangements for use with circuits having redundant circuit functions.
A desire for the highest reliability in electronic equipment used for certain critical applications, such as in aircraft electronics, has resulted in the increasing use of redundancy in the design of these products. This redundancy is applied to two general areas within aircraft power system electronic equipment: the internal power supplies, and circuits which perform specific functions. Either or both of these areas can be duplicated or "backed up" by additional circuits or components inside the equipment.
There are two well-known methods of using dual redundant power supplies. The first method uses diodes to OR the outputs of the two supplies, while the second uses sophisticated load-sharing controls with suitable isolation to control the operation of the supplies. The former method provides adequate isolation with no loss of bus voltage if the output of one supply shorts. Also, the supplies used in such designs can be relatively simple as they require no load sharing controls. However, this method may be undesirable for applications which require low voltage levels with tight tolerances, such as those required by many integrated circuit families. The diode drop inherent in this approach typically uses up or exceeds the available tolerance band of the supplied voltage. The latter method is acceptable in such situations since it provides a tightly regulated voltage in the center of the tolerance band, but results in increased sophistication and decreased reliability of the supplies due to the load-sharing and output isolation requirements.
Circuit function redundancy can be implemented at various levels in the equipment including the component, circuit, and printing wiring board or card level. At the circuit card level, redundancy is typically of two types: active or standby. Active redundancy implies that both cards are powered simultaneously and, given the same inputs, provide the same outputs to some controlled device. The controlled device is assumed to be sophisticated enough to discern the difference between signals from a good card and a failed card. Often, more than two such cards are used to support a majority vote function in the controlled device. In addition to the added complexity of combining the outputs in such a way as to ignore a failed circuit card, another drawback exists in the reliability gained in having a redundant circuit card. By powering the cards together, the net gain in overall reliability is less than that realized by the standby redundant approach. Higher net increases in reliability can be achieved in the active approach if the number of redundant cards is increased. However, that may be unacceptable in applications where an increase in weight, size or complexity is undesirable.
Standby redundancy represents the largest net gain in overall reliability with the least increase in complexity. This method implies that the backup or redundant circuit card is not powered until it is needed (due to a failure in the primary or active card) by the equipment. Such designs require a switch to turn the active (failed) card off and the standby card on. The trade-off in such designs involves the reliability of the circuit card versus the reliability of the switch and its controls.
A typical application involving both dual redundant power supplies and dual redundant circuit cards may include diode-connected power supplies in combination with active and standby circuit cards. The power to the redundant circuit cards is controlled by sensing logic which, upon detecting a failure in the active circuit card, transfers the control power to the standby card via a relay. Some type of start-up logic would be required and the system must be capable of transferring power to the standby card should the active card short out the power bus. The switching relay would be large and of somewhat low reliability, given a pole for each voltage bus switched. Regardless of how the power transfer is accomplished, a major concern with this approach is the fact that no matter where the isolation diodes are located, a short on the active card (or the standby card, if activated) power bus will cause an interruption of voltage to all other cards on the redundant power supply bus.
It is therefore desirable to devise a redundant power bus arrangement which eliminates the need for the large and somewhat low reliability relay and also addresses the shorted common bus problem so that a shorted bus within one of the controlled circuit cards does not cause a loss of voltage to all of the other circuit cards on the redundant power supply bus.